linux-kernel - [PATCH 2/2] KVM: x86: Allow userspace to define what's the microcode version

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 26 Nov 2017 17:41:22 +0100
From:   Filippo Sironi <sironi@...zon.de>
To:     pbonzini@...hat.com, rkrcmar@...hat.com, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     Filippo Sironi <sironi@...zon.de>
Subject: [PATCH 2/2] KVM: x86: Allow userspace to define what's the microcode version

... that the guest should see.
Guest operating systems may check the microcode version to decide whether
to disable certain features that are known to be buggy up to certain
microcode versions.  Address the issue by making the microcode version
that the guest should see settable.
The rationale for having userspace specifying the microcode version, rather
than having the kernel picking it, is to ensure consistency for live-migrated
instances; we don't want them to see a microcode version increase without a
reset.

Signed-off-by: Filippo Sironi <sironi@...zon.de>
---
 arch/x86/kvm/x86.c       | 23 +++++++++++++++++++++++
 include/uapi/linux/kvm.h |  3 +++
 2 files changed, 26 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 925c3e29cad3..741588f27ebc 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4033,6 +4033,29 @@ long kvm_arch_vm_ioctl(struct file *filp,
 	} u;
 
 	switch (ioctl) {
+	case KVM_GET_MICROCODE_VERSION: {
+		r = -EFAULT;
+		if (copy_to_user(argp,
+				 &kvm->arch.microcode_version,
+				 sizeof(kvm->arch.microcode_version)))
+			goto out;
+		break;
+	}
+	case KVM_SET_MICROCODE_VERSION: {
+		u32 microcode_version;
+
+		r = -EFAULT;
+		if (copy_from_user(&microcode_version,
+				   argp,
+				   sizeof(microcode_version)))
+			goto out;
+		r = -EINVAL;
+		if (!microcode_version)
+			goto out;
+		kvm->arch.microcode_version = microcode_version;
+		r = 0;
+		break;
+	}
 	case KVM_SET_TSS_ADDR:
 		r = kvm_vm_ioctl_set_tss_addr(kvm, arg);
 		break;
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 282d7613fce8..e11887758e29 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -1192,6 +1192,9 @@ struct kvm_s390_ucas_mapping {
 #define KVM_S390_UCAS_UNMAP      _IOW(KVMIO, 0x51, struct kvm_s390_ucas_mapping)
 #define KVM_S390_VCPU_FAULT	 _IOW(KVMIO, 0x52, unsigned long)
 
+#define KVM_GET_MICROCODE_VERSION _IOR(KVMIO, 0x5e, __u32)
+#define KVM_SET_MICROCODE_VERSION _IOW(KVMIO, 0x5f, __u32)
+
 /* Device model IOC */
 #define KVM_CREATE_IRQCHIP        _IO(KVMIO,   0x60)
 #define KVM_IRQ_LINE              _IOW(KVMIO,  0x61, struct kvm_irq_level)
-- 
2.7.4